title: Exploiting SetupComplete.cmd CVE-2019-1378
id: 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
status: test
description: Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
references:
- https://web.archive.org/web/20200530031708/https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua
author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
date: 2019-11-15
modified: 2021-11-27
tags:
- attack.persistence
- attack.privilege-escalation
- attack.stealth
- attack.t1068
- attack.execution
- attack.t1059.003
- attack.t1574
- cve.2019-1378
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentCommandLine|contains|all:
- '\cmd.exe'
- '/c'
- 'C:\Windows\Setup\Scripts\'
ParentCommandLine|endswith:
- 'SetupComplete.cmd'
- 'PartnerSetupComplete.cmd'
filter:
Image|startswith:
- 'C:\Windows\System32\'
- 'C:\Windows\SysWOW64\'
- 'C:\Windows\WinSxS\'
- 'C:\Windows\Setup\'
condition: selection and not filter
falsepositives:
- Unknown
level: high